241

I thought that there was no need to scan for viruses either in Ubuntu or any Linux distros until I found virus scanner packages clamtk and klamav in Ubuntu software center yesterday.

This leads to the following questions:

  • How do viruses differ between Linux and Windows?
  • How do the strategies for protection differ between Linux and Windows?
  • Should a virus scanner package be installed on my system? If so, which would be a better option?
11

24 Answers 24

145

There are viruses for most all platforms (the first worm was for DEC VAX) , they are just more common on Windows. Different platforms are more secure than others, but a virus can typically gain user level security, which is often good enough, on most platforms. You can actually run Windows without a virus scanner if you keep it patched and are really careful.

Differences from Windows to Linux for viruses: On Linux it is harder for the virus to get root (or system) level access. But it could probably still access your address book or saved passwords in Firefox (user level access).

Strategy: If you are really careful and know what you are doing you can get away without a scanner. A good strategy is to have your scanner just scan downloads or if you are bringing a file from another computer on a USB drive or floppy disk (assuming you have one). If you want you can have it do regular full system scans too. It is all about how paranoid you are, and how likely you are to get a virus.

For your laptop I would suggest only having the scanner scan downloads and when you are brining files from another computer. Having it do full system scans can be a battery drain.

A very important element of a virus scanner is having it updated with new signatures, so pick the package that has the best signature updates, and that works best for how you want to use it.

15
  • 56
    And if you don't think user-level security is enough to do damage: how would you feel if I did rm -rf $HOME?
    – Roger Pate
    Oct 30, 2010 at 6:54
  • 26
    Yeah, user level access is usually enough to ruin your day. Oct 30, 2010 at 20:39
  • 19
    This whole thread is just paranoia. Viruses can't infect Linux system in normal desktop use as all programs run from system binaries that cannot be modified by user-level security. If user-data can somehow maliciously gain execute permission (which is so unlikely it just boggles the mind), at most it can destroy data but can't replicate itself so its not a valid vector for viruses - maybe for personally targeted attacks, but if you think you could be the subject of one then running anti-viruses will likely not help you against those.
    – Guss
    Apr 15, 2011 at 13:26
  • 10
    Just a question: syncing means that deleting home will delete dropbox files too, right? :)
    – Pitto
    Apr 15, 2011 at 13:53
  • 4
    @Pitto. Dropbox files can be undeleted for a certain length of time (depending on what service you're paying for).
    – TRiG
    Aug 22, 2011 at 18:21
62

Both klamav and clamtk are front-ends for the clamAV software. They do check for linux viruses, but they are most useful for making sure your linux computer isn't sharing infected files with windows machines. Most of the virus scanners for linux are actually for servers, and are meant to scan email or uploaded files as they are sent.

Wikipedia has a list of Linux malware, which should help inform about the risks: Linux malware - Wikipedia, the free encyclopedia. They list 30 viruses and various other possible threats.

2
  • 5
    Exactly. I have seen so many Linux computers at work, both desktops and servers, and the few ones that need an antivirus only need it to clean the emails they route (or files they store) in order to lower the odds that Windows computers around get hurt. Apr 27, 2011 at 6:10
  • If you follow statistics about Linux viruses in the wild, you'll often find them in a category of 0-49 infections. :) 0-2 sites infected. On servers, you find malware, but on the desktop, there isn't. Feb 17, 2012 at 17:06
45

You may not need a virus scanner per se, but you sure do need to keep your system up to date and secure (good passwords and system practices - permissions etc)

Personal Anecdote: I had a debian server running, It had an uptime of 400 days and I wanted to get to 500 before restarting it to update the kernel, I was being silly, and too cocky about it being a linux system . Since it was a server that served a research group, I gave all of my coworkers an ssh account. Turns out that some hacker exploited a bad password by one of my users and loaded on automated script that ran through 5 or 6 exploits before finding one that worked (an exploit that was patched, had I updated the kernel). It rooted the server and then proceeded to set up a bot (Campus IT caught the hack before I did, they noticed suspicious IRC traffic and contacted me).

Funny story, is that I used those same scripts to take back control of the machine to backup some raw data before nuking the system.

Long story short, keep your system up to date, keep your passwords secure, maintain good administrative practices. And unless you literally go and do sudo rm -rf /* because someone online told you to, it's unlikely you will ever have any trouble with your linux computer.

0
28

It's not needed since (contrary to popular lies), linux is rather secure, and you are unlikely to get a virus for linux. Your risk is higher that you might pick up a windows virus while running wine, or that you may get hacked by a remote user (a rare occurrence on the desktop).

My suggestion: install gufw from software center, enable your firewall, along with some optional rules if you like, and optionally install clamav as well (along with fresh-clam).

Overall, your best defense, is to be armed with knowledge. A good way to do that is to get a feed reader like liferea, and follow popular linux sites like omgubuntu or sites like /. (slashdot) for news related to linux security. Don't run software from people you don't trust (that means, be careful with shady ppa's, use software that's in the standard repos where possible, and don't run strange plugins on websites, even if it is kinda funny when they fail to infect your linux system =P)

Hope that answers your question =)

edit: viruses are the same on every system in the sense that they all try to use a vulnerability or a user's ignorance to propagate themselves or access something they should not. It's no different on linux, but linux is more secure, way more secure. The antivirus software you saw is actually mainly there to protect windows users; for example if a friend sends you an infected file, you might pass it on to a windows user without being affected yourself.

11
  • 6
    Java exploits are becoming more common w/ Linux being affected. Flash is a buggy pile with recent vulnerabilities affecting Linux too. I think I'm the only Ubuntu user I know who doesn't have Flash installed.
    – Broam
    Oct 30, 2010 at 5:37
  • 5
    that still doesn't put most common users at risk, or require antivirus software. In fact those vulnerabilities are getting no where fast on linux.
    – RolandiXor
    Oct 30, 2010 at 5:40
  • 2
    You are unlikely to get a virus for linux. But not because linux is rather secure. Linux is rather secure, but this doesn't mean that it's difficult to find ways. I was quite impressed when I first read how to write a Linux virus in 5 steps. I don't want to say that we need anti virus software. We are just lucky that most viruses are not targeting Linux (for whatever reason) and the average Linux users has more knowledge about do's and don'ts.
    – lumbric
    Jan 17, 2012 at 22:54
  • 4
    @lumbric: sigh. This has been gone over so many times... BTW, I took a look at the link, and I don't see how that negates my answer or requires a downvote. Also, we are not just lucky - Linux is widely used on webservers, and believe me, they do get attempted attacks quite often. Also, while it is true that the average Linux user of the 90's and early 2k's has more knowledge about do's and don'ts, that is not true anymore - and yet we don't see an increase in viruses being propagated.
    – RolandiXor
    Jan 18, 2012 at 0:48
  • 1
    @lumbric: Don't forget such things as apparmor and selinux, and more.
    – RolandiXor
    Jan 18, 2012 at 0:52
25

No, you do not need an Antivirus (AV) on Ubuntu to keep it secure.

You need to employ other "good hygiene" precautions, but contrary to some of the misleading answers and comments posted here, Anti-virus is not among them.

For starters, there seems to be a confusion in some of the top-rated answers here between two issues:

  1. Existence of viruses for Linux and
  2. Ability to actually infect a system.

These two are not the same. There definitely are 'viruses' that can run on Linux, but in order to make them run, a malicious user needs to get someone with local privilege to actively install them. This requires the owner of the system to trust the malicious user, download the software, and use sudo with a password to install it, (or run it as a regular user to cause some regular-user level damage). Not a trivial set of barriers to overcome.

Unlike on some other systems, a regular user who keeps their Ubuntu system up-to-date on security fixes (very easy to do), cannot normally install something by accident (e.g. by opening an attachment, or clicking on something). The exception is unknown zero-day vulnerabilities, but for those AV will be totally ineffective anyway. An Ubuntu user doesn't work with admin privileges by default, and remote root logins are disabled.

In addition, Ubuntu comes with:

  • Random address loading (which foils most drop-to-shell attempts)
  • Application restrictions/barriers via apparmor so an application like firefox can only access a very restricted subset of files and actions for example (see /etc/apparmor.d/usr.bin.firefox)
  • Built-in firewall (iptables) which can be set-up to be very restrictive

So to be secure, you need to adhere to basic rules of safety such as:

  1. Keep your software up to date
  2. Only run software downloaded from official repositories (or software you wrote yourself, or can audit the source code of)
  3. Only use your standard package-manager for installs. In particular do not install proprietary binary stuff from random sources which you can't audit by looking at the source code using apt-get source).
  4. Have a home firewall & do not run unnecessary services
  5. Regularly run some log scanning to detect unusual activity -- I recommend logcheck
  6. Add a local iptables based firewall for another defense perimeter layer
  7. Keep your passwords long and secure (a good password manager is recommended). Use two-factor authentication wherever possible.
  8. Use encrypted sessions (use ssh and scp, and not ftp or telnet)
  9. Use containers (e.g. docker or systemd-nspawn images) - by running software in isolation from the rest of the system, even the most buggy/vulnerable software, won't be able to cause damage outside its container. Container-technology means basically game-over for compromised software.

If you follow these sensible guidelines, you'd be way safer than you would be by installing a non-opensource 'AntiVirus' (how can you trust such software?) and falling into a false, and highly deluded, sense of security.

Of course, if a malicious user asks you to download badstuff.deb from somewhere and install it by opening a terminal window and typing:

sudo dpkg -i badstuff.deb

and you oblige, all bets are off, and you have only yourself to blame for being infected. An AntiVirus is pretty unlikely to save you in this case. Unless this particular badstuff.deb is among the finite set of blacklisted signatures.

As others have mentioned clamav "for Linux" is designed as a scanning server to other (non-Linux) systems.

Some of the answers and comments here make the following non-sequitur claim: "since user-level damage can be very harmful (e.g. removing $HOME and everything under it), sudo access is irrelevant. You need AV anyway."

This is a red-herring logical fallacy. You can willfully (or accidentally) remove $HOME anyway, with or without a virus. The critical question, is again: do you run random code from untrusted sources or not. If you do, AV (or any other precaution) won't save you from yourself willingly damaging your system.

On Ubuntu, the whole system and software repository ecosystem is designed to prevent running random code from random sources, thus installing an AV to "protect Ubuntu from viruses" is a waste of time and resources.

Some answers here suggest installing a commercial, non-open source, AV software on Linux. Don't do this. AV software runs with elevated privileges, often changes system-call semantics (e.g. change open() to scan a downloaded file and possibly fail), and consumes very significant (memory, CPU, disk, network) resources. Such software cannot be audited so it is impossible to trust. Installing such software on your otherwise pretty secure Linux system, would dramatically increase the surface of attack of your system and make it far less secure.

References:

  1. Are signature based antivirus or anti-malware effective?
  2. What automated intrusion notification/detection setup is good for home desktop use?
  3. Is it easier to write viruses for Windows compared to OS-X and Linux (Quora)
  4. Google: Symantec antivirus flaws are "as bad as it gets"
  5. Setting up iptables - Ask Ubuntu question
  6. systemd-nspawn on Arch wiki
5
  • 2
    This answer form Security.SE shows that Ubuntu is far less secure than we think, and it's only a matter of time a until successful wide-scale malware infestation occurs. Sep 20, 2016 at 6:21
  • 1
    That answer has many inaccuracies. Anyone advocating (in any way) installing unauditable and highly-privileged software like commercial anti-virus on Linux is misguided. No complex system is 100% secure, but installing AV is making it much worse. Please read links 3 and 4 in the references above for why it is so.
    – arielf
    Sep 20, 2016 at 23:44
  • What about running something like rkhunter on the machine? Its open source and could potentially detect rootkits that have been inadvertently installed. Of course, a rootkit virus could pretty easily detect and thwart rkhunter, but maybe it won't?
    – B T
    Nov 26, 2019 at 19:54
  • 1
    @BT rkhunter is ok, can't hurt except for taking minimal resources. I used to run rkhunter for many years, but no longer do because it never found anything meaningful on my systems. rkhunter's main value is not in its rootkit black-list, but mostly in its general heuristic checks: are there any hidden directories? Have executables changed since last check? Is there suspicious stuff in /tmp or /dev? & similar broad checks which have long-lasting value. If you use it, make sure to run rkhunter --propupd periodically, to avoid false-positives on auto-updated executables.
    – arielf
    Nov 28, 2019 at 2:16
  • 1
    So glad that you're keeping you answer up to date. Hopefuly someday it may float to the top of the thread. Thanks!
    – brasofilo
    Apr 23, 2022 at 16:39
10

Basic ecology, man. Monocultures suffer from parasite plagues more than endemites. Popularity of Windows and the fact that there is just a handful of different configurations make them an easy and profitable target. How many boxes are out there with that precise version of the kernel that you are running? Of the software that you are running?

Also, in Ubuntu, you have security updates on an almost daily basis, rather than waiting for the next service pack.

Furthermore, 99% of the software you are running comes from trusted sources.

That said, AV might still be useful, for example to check Windows files, including your WINE programs. Also, in fact, there are some Linux viruses out there; but they have a very hard time spreading and so are not, in general, a major concern. Read more here.

And, of course, Linux does not protect you from bugs in Javascript or web browsers.

You can see a brief description of Linux antivirus programs here.

5

There are some theoretical viruses that target Linux systems (whether specifically or cross-infectors that propagate through Ms-Windows), But there has never been a documented infection of Linux programs in normal desktop use.

If you are in the habit of regularly downloading Windows programs from the internet and running them using wine, then you should get an anti-virus to scan them. You might also think about limiting your wine usage to a different user account - in case a malicious windows program (infected or otherwise) wants to destroy your user data.

Otherwise, don't bother.

5

I always run an Antivirus on my systems - nevermind if it's Windows, OSX or Ubuntu/Linux. Never think you are safe - a system can ALWAYS be hacked or infected - even Linux based distros. I remember the one time I got malware from Gnomelook.org on Ubuntu, because I installed a screensaver for my Ubuntu system. Read here.

And I have had 1-2 other Java malware coming on my Ubuntu system, because they were targeted for OSX and Windows, but it also ran on Ubuntu/Linux. Who knows what else I had during that time, because I didn't use an Antivirus.

Sure, the threat is much smaller right now (for Ubuntu/Linux based distros), but like Android: Once it gets more popular - you will see much more malware rise from the hidden ashes, because it's possible now already (my personal opinion combined with what I mentioned before).

I use the free and personal edition of "Bitdefender" on my Ubuntu system, because Avast wasn't working with "Ubuntu 12.04" and everything else was too difficult to set-up. Sure, ClamAV is good and easy (it's in the Ubuntu Software Centre), but their reaction time to threats (at least in the past) has been very, very slow. ClamAV also misses a lot of Windows viruses -> detection rate is not that good, at least when compared to commercial products (like Bitdefender, Avast, etc).

Verdict: Just my two cents on the subject. Never think you are safe, because you are not. A system can always be infected one way or the other - always. I haven't had a single problem with Bitdefender on Ubuntu and while an Antivirus/Security solution can never give you 100% security - it is better than nothing. I have been infected with malware both on OSX and Linux - on two systems where most ppl in the community said it couldn't happen or where I was told an Antivirus is not needed: Community Link

Oranges

1
  • 2
    Once you start on the slippery slope of installing non open-source software which you can't audit (like bitdefender) from places that are not the official Ubuntu repositories - yes, you might have introduced a security issue to an otherwise pretty secure system.
    – arielf
    Aug 4, 2014 at 0:06
3

You can try BitDefender Antivirus for unices. Its one of the best scanners ive tried with a intuitive GUI and regular updates. Unfortunately its a on demand only scanner but good for those e-mail attachments and USB Drives.

http://www.bitdefender.com/world/business/antivirus-for-unices.html

3

Speaking of all the security issues in general, but leaving out the viruses, Ubuntu has build-in security.

However, Ubuntu will not stop you from installing malware like the Windows anti-viruses try to do. For example, if someone tricks you into installing software that will spy, spam, or destroy all your data then you're out of luck.

Many more security mechanisms are available if you choose to set them up: firewall rules, anti-virus scanners, network monitoring, two-factor authentication, etc... These additional mechanisms are mostly intended for servers and you should not need to worry about them as a desktop user.

Having that said, there are many vulnerabilities and Linux systems get broken into every day all over the world. Security teams come-out with updates to fix these vulnerabilities regularly. Ubuntu has it's own security team that releases updates and advices for systems administrators.

Here is an overview about anti-Viruses and Ubuntu security.

In practice Ubuntu is much safer than Windows. In terms of exposure to malware, Ubuntu is comparable to Mac. But as @Giacomo pointed out, living in a nearly virus free world can leave Mac users naive.

The top 2 things that you can do to stay extra safe:

  1. Install software only from the official repository
  2. Keep your software up by letting the Update Manager do it's thing
3

Yes Ubuntu has a default firewall, but you need to configure it

Ubuntu uses ufw to configure the firewall. But it may not be enabled by default.

To enable the firewall open a terminal and type:

sudo ufw enable

Further info can be found in ufw's man page. In a terminal type:

man ufw

Coming to antivirus part, ubuntu does not have a default antivirus, nor does any linux distro I know, You dont need a antivirus program in linux. Although, there are few available for linux, but linux is pretty much safe when it comes to virus.

3

The short answer is NO, but if you share files with a Windows operating system then it wouldn't hurt to install a virus tool that you can run on your flash-drives and such to check if they are clean before distributing them among Windows users.

Any viruses contained in files from a Windows machine will only affect the same computers.

3

I disagree with traditional answers that claim that no virus scan is needed. It is exactly that attitude that is making linux more and more vulnerable.

The only reason that no virusscan is needed is because black hackers tend to focus more on Window$ and portable devices. We actually have very little data about the actual amount of viruses and trojans in linux. This is also because there are very few security firms working on it. There are a few minor, public tools. There have been viruses in the past:

Alaeda – Virus.Linux.Alaeda
Binom – Linux/Binom
Kagob a – Virus.Linux.Kagob.a

Don't "live in denial about linux malware." There is even a little guide, a how to.

That said, there is a virusscan in linux. It is a bit harder to use than traditional windows scanners, but I have used it in the past to get rid of viruses on jump drives that were infected on window$:

 sudo apt-get install clamav  # to install it
 man clamav  # for more info

Don't worry too much about viruses, but don't pretend that there is 100% certainty that they do not exist. So my answer is: there is probably no need to install a virusscan that is continuously monitoring your system, just don't think that there will never be or never have been linux viruses or that you will never need a virusscan.

7
  • 4
    This should/could be posted here: askubuntu.com/questions/10373/… ;) And I disagree: as long as your sudo password is safe so is your system.
    – Rinzwind
    May 1, 2014 at 7:43
  • 1
    There is no recorded instance of a virus in a personal linux computer as far as I am able to make out. The reasons hackers don't attack is because of permissions, ownership and strong security built into linux systems - things that have been lacking in windows and only partially dealt with over the years. May 1, 2014 at 8:21
  • @don.joey : totaly agree with you . the higher the value of the target the much more interested hunters involvements . with the grow of linux the higher value will attract other professionals to concentrate on it
    – Fat Mind
    May 1, 2014 at 8:43
  • 1
    I am aware of that point of view, but as I say, there is no reported instance so far. It is safer because linux has strong built in security. May 2, 2014 at 9:58
  • 1
    @comrademike: xkcd.com/1200 Sep 20, 2016 at 6:23
3

Actually not, there is a really low chance to get a virus using linux; to avoid malicious packages, try to install software only from the software centre or PPAs that you trust. If you want to scan your files for windows viruses (in order to prevent your friends' PCs infection when exchanging files), you can use CLAMAV (which is the best natively-supported Linux antivirus)

2

I am not worried about my Ubuntu gets infected with virus because I know the chances are very slim , but I have avast installed in case my windows gets infected I can clean it from Ubuntu using avast ( I have dual boot, XP and Ubuntu).

0
1

Its needed if you wanna scan your NTFS partitions..I use opensource antivirus clamav to scan my NTFS drives.It is awesome,but some times the result may be false positive,so be sure before you delete a file..Cheers....!

1

Security is a matter of how you use your computer. Thinking before acting, most of the times is the best Antivirus/Malware protection mechanism.

For users coming from Windows having an Antivirus seems to be essential but they are tricked into a false sense of security. Before clicking on a mysterious link just because Bob told you that the flash video there is awesome and you just have to check it out is such a potential risk.

Always think twice before visiting a certain site or opening a certain file. If it stinks like fish it probably is fish.

Now to answer your question. No, as long as you don't plan to have Windows machines on your network or to interact with them in any way by transferring files for example then no you won't need any Antivirus. If there are Windows machines in your network or you plan to transfer files from/to such a Windows machine then to protect the Windows machine you should use one of the already mentioned Antivirus packages.

The security team is doing a great job at fixing vulnerabilities but this task is most of the times to be performed as a reaction to a certain vulnerability, just keep that in mind.

1

A virus is computer program that writes itself to another program, which would then write itself to other programs and so on. In Ubuntu, only root is allowed to write to executables. This means that a virus would have to gain root access before it could infect your system. So even if the virus did reach your computer, it would be very difficult for it to actually infect it. It is not impossible, but difficult.

But a virus is not a virus unless it is able to actually spread. It is very uncommon for users to copy software directly between themselves. Instead, you'd download the software from the distributor, who has compiled the code from source and then signed it. First of all, this means that a virus would be incapable of spreading because it isn't being copied. But it also means that Ubuntu would actually refuse to install infected software quite simply because the certificate would no longer be valid. When you install Ubuntu from a CD, you can test the CD for errors. It's the same principle. If the software has been changed, then it is no longer valid. Whether that's because of tampering or a bad download, is actually quite irrelevant.

In other words, there are many reasons why viruses will have an insanely small chance of surviving in Ubuntu. So much that it can be considered almost impossible.

However, viruses are only one kind of malicious software. The anti-virus manufacturers like to use that expression for everything because of the fear factor. It is completely possible to make other kinds of malware, like trojans. Actually, this is a little bit easier on Ubuntu than other operating systems, using PPAs for instance, but also easier to detect. So in other words, even if Ubuntu is mostly immune to any kind of virus, it is not safe to assume that it is safe to run just any software.

1

Linux itself has some pretty neat security measures already, and the nature of linux there isnt much malware out there to begin with , so AV is not essential.

The reasoning behind that can get complicated , you may want to research it

1

You ask if you need antivirus software on you desktop. My answer is not about technical issues, it is about legal ones. Where I live, banks require you to have antivirus software installed on the computer which you use for online banking. If you have antivirus (and some other measures), there's a good chance that you get your money back. It depends on many things, and there is no guarantee, but they actually do this. From their own logs they can see many things and they see patterns that show that the account really is hacked.

If you don't have antivirus, and your account gets hacked, they can blame you and they might refuse to refund your money. Then you can go to court and prove them wrong, but are you willing to take that risk?

0

All software platforms need virus protection. However the majority of viruses are written for Windows and will not affect Linux. However, there is till the potential of cross-platform type viruses (Flash, Java PDF, etc) that can still do some damage on any system. Also, Linux can be a "carrier" and still spread viruses by e-mail or flash memories without you knowing about it because it had no effect on you. Therefore, I recommend installing Clam (Gnome) or Klam (KDE). This does not run in the background and needs to be updated and run manually about every week or so.

2
  • 2
    freshclam provides automatic updates =)
    – RolandiXor
    Oct 30, 2010 at 4:43
  • 23
    I strongly disagree. There is absolutely no need to scan for viruses on the Ubuntu Desktop. All the virus scanners in fact scan for Windows malware. If you care at all about being a carrier, sure, but your statement suggests that all linux users should install anti virus software. On the desktop, it is almost never justified. Sorry for being so shouty about this :-( Oct 30, 2010 at 5:03
0

The problem with scanning for viruses on Linux vs on Windows is that it is more trouble than it is worth. Scanning manually takes more diligence and commitment than most people have. Setting it up to scan in the background is tricky at best and impossible for most users.

So you can do it, if you have the time and patience, but for me it is wasted effort. I don't use Windows and people who do, deserve what they get, IMO. When you choose Windows, it comes as part of the package deal. When you choose Linux, you get out of all of that nonsense. The security is built in and there are few enough viruses for Linux that you can stop worrying about it.

0

I am not running anti-virus on any of my computers that has linux installed. I'm not gonna say that you don't have to, but I chose not to.

To run a file on linux, you need to change the permissions for the file which requires super user priveliges. In addition, Microsofts windows are a greater market for virus-writers. You do not make a product that will be useable for a tiny amount of the market. The same rule applies to virus-writers. They will write harmful code to the platform where there are most users.

Another factor is in fact your own browsing. If you're visiting doubtful pages this increases your risk of getting harmful code on your computer.

The recent java-hole however, which resulted in malicious code could get the same priviliges as the java applet you were running could be fatal.

This could in theory download a file to your computer and give it privileges to run as an executable.

A lot of security holes in linux is actually security holes in the applications you install.

This post does not imply that you shold not install anti virus. Trust your guts! :)

0

Does Ubuntu need anti virus. Let me share our recent experience, we are coming to the end of of redeveloping or site on a new Linux server, running Ubuntu, ROR & Mongo. The server is to deploy our multiple directories which will accept Video/Audio and Text data. The server is still in dev mode and NOT public facing.

But we have had 2 instances of malware being installed, for spam distribution, this was picked up by the ISP as unusual traffic for a server in Dev mode. developing. This server does not have any inbound traffic apart from the developers (who) naturally are denying they are the source. But who else can it be as they are the only ones with access.

My point is, that once we have deployed to the live server users of our service will be able to create links YouTube etc, upload images, video, audio files, data and Pdf's.

Fortunately these 2 attacks have occurred during dev phase, had they occurred once the site is released it would have killed our service as the server would have had to be taken down.

So, whilst I understand the majority sentiment that Linux/Ubuntu is safe, I am afraid, from our experience it is not. Therefore we are having to investigate what security solutions are available.

1
  • Sounds like an open-relay being actively exploited on a "not public facing" computer. Does this mean the whole development network can't be trusted anymore? How can a "not public facing" computer be relaying unusual traffic as detected by the ISP? You mention two instances of Malware. How were they installed? Obviously someone with privileges and access has put them there. Sounds like a badly configured system with open access. Nothing, anti-virus or otherwise, can really help here.
    – arielf
    Feb 21, 2015 at 23:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .